diff --git a/src/site/fml/faq.fml b/src/site/fml/faq.fml index 568cb6c1a1..054dcb4b6b 100644 --- a/src/site/fml/faq.fml +++ b/src/site/fml/faq.fml @@ -126,5 +126,47 @@ org.springframework.security.AccessDeniedException: Access is denied

+ + + I've configured the "requires-channel" attribute to use HTTPS for my login page and switch back to HTTP afterwards but I just end up back at + the login page after authenticating. I'm using Tomcat. Why doesn't it work? + + +

+ This happens because Tomcat sessions created under HTTPS cannot subsequently be used under HTTP and any session state is lost (including + the security context information). Starting in HTTP first should work. +

+ + + + + I'm forwarding a request to another URL using the RequestDispatcher, but my security constraints aren't being applied. Why not? + + + Filters are not applied by default to forwards or includes. If you really want the security filters to be applied to forwards and/or includes, + then you have to configure these explicitly in your web.xml using the <dispatcher> element, a child element of <filter-mapping>. + + + + Common "How To" Requests + + I need to login in with more information than just the username. How do I add support for extra login fields (e.g. a company name)? + +

This question comes up repeatedly in the Spring Security forum so you will find more information there.

+

+ The submitted login information is processed by an instance of AuthenticationProcessingFilter. You will need to customize this class to handle + the extra data field(s). One option is to use your own customized authentication token class (rather than the standard UsernamePasswordAuthenticatioToken), + another is simply to concatenate the extra fields with the username (for example, using a ":" as the separator) and pass them in the username property of + UsernamePasswordAuthenticatioToken. +

+

+ You will also need to customize the actual authentication process. If you are using a custom authentication token class, for example, you will have to write an + AuthenticationProvider to handle it (or extend the standard DaoAuthenticationProvider). + If you have concatenated the fields, you can implement your own UserDetailsService which splits them up and loads the appropriated user data to use + for authentication. +

+ + + \ No newline at end of file